Pro-Ukraine hackers recently had a field day disrupting the services of the Russian airline carrier Aeroflot. The company was founded in February 1932, approximately 93 years ago. Previously, Aeroflot was regarded as one of the largest airlines across the globe. Since 1992, the airline has been divided into 400 regional airlines. These were informally called Babyflots and restructured into a more open joint-stock company.
Some difficult decisions for Aeroflot
Russian airline Aeroflot AFLT.MM was forced to cancel more than 50 round-trip flights on Monday, disrupting travel across the world’s biggest country, as two pro-Ukraine hacking groups claimed to have inflicted a crippling cyberattack. The Kremlin said the situation was worrying, and lawmakers described it as a wake-up call for Russia. Prosecutors confirmed the disruption at the national flag carrier was caused by a hack and opened a criminal investigation.
Senior lawmaker Anton Gorelkin said Russia was under digital attack. Another member of parliament, Anton Nemkin, said investigators must identify not only the attackers but “those who allowed systemic failures in protection”. Aeroflot did not say how long the problems would take to resolve, but departure boards at Moscow’s Sheremetyevo Airport turned red as flights were cancelled at a time when many Russians take their holidays.
A critical cyberattack on an important industry
The company’s shares were down by 3.9% by 1533 GMT, underperforming the wider market, which was 1.3% lower. A statement purporting to be from a hacking group called Silent Crow said it had carried out the operation together with Belarusian Cyberpartisans, a self-styled hacktivist group that opposes President Alexander Lukashenko and says it wants to liberate Belarus from dictatorship. As can be seen with the Aeroflot incident, the hacking group “Silent Crow” utilizes various hacking techniques to exploit the vulnerabilities in infrastructure.
They have been known to utilize more advanced strategies such as generative neural networks as well as deepfakes to enhance some of their attacks. Belarusian Cyberpartisans said on its website: “We are helping Ukrainians in their fight with the occupier, carrying out a cyber strike on Aeroflot and paralyzing the largest airline in Russia.” The Belarusian Cyberpartisans is a decentralized, yet anonymous hacktivists collective. It first emerged in September 2020.
The havoc that hackers can cause
They are known for a variety of cyber-attacks against the authoritarian Belarusian government. Silent Crow has previously claimed responsibility for attacks this year on a Russian real estate database, a state telecoms company, a large insurance firm, the Moscow government’s IT department, and the Russian office of South Korean carmaker KIA. Some of those resulted in big data leaks.
Aeroflot said it had cancelled 54 round-trip flights but planned to operate the remaining 206 out of a total of 260 scheduled for Monday. An online departure board for Sheremetyevo airport showed dozens of flights were delayed by hours. The statements from Silent Crow and Belarusian Cyberpartisans said the cyberattack was the result of a year-long operation that had deeply penetrated Aeroflot’s network, destroyed 7,000 servers, and gained control over the personal computers of employees, including senior managers.
Since Moscow launched its war in Ukraine in February 2022, travelers in Russia have become used to flight disruptions, usually caused by temporary airport closures during drone attacks. Russian companies and government websites have been subjected to sporadic hacking attacks, but Monday’s was potentially the most damaging, because of the widespread disruption and the high profile of Aeroflot.
Despite Western sanctions on Russia that have drastically limited travel and routes, Aeroflot remains among the top 20 airlines worldwide by passenger numbers, which last year hit 55.3 million people, according to its website. Cyberattacks have consequences. This is especially prevalent in situations where critical infrastructure is affected, such as an airline, for instance. Here, there is a very real possibility that there can be a loss of life if things go wrong. The increase in the frequency of these cyberattacks on airports recently has placed the spotlight on these vulnerabilities.